Skip to content

Commit e1696c0

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-22xp-w9q9-jfg2 GHSA-27jg-5m5x-f2g4 GHSA-fxq6-r9jg-wqh8 GHSA-jm9m-9mxg-ppp4 GHSA-vwr5-vc8h-j5xm
1 parent db66be3 commit e1696c0

5 files changed

Lines changed: 258 additions & 0 deletions

File tree

‎advisories/unreviewed/2025/05/GHSA-22xp-w9q9-jfg2/GHSA-22xp-w9q9-jfg2.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-22xp-w9q9-jfg2",
4+
"modified": "2025-05-25T00:31:50Z",
5+
"published": "2025-05-25T00:31:50Z",
6+
"aliases": [
7+
"CVE-2025-5135"
8+
],
9+
"details": "A vulnerability, which was classified as problematic, has been found in Tmall Demo up to 20250505. Affected by this issue is some unknown functionality of the file /tmall/admin/ of the component Product Details Page. The manipulation of the argument Product Name/Product Title leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5135"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/bdkuzma/vuln/issues/14"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.310214"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.310214"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.571941"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-05-24T23:15:23Z"
51+
}
52+
}

‎advisories/unreviewed/2025/05/GHSA-27jg-5m5x-f2g4/GHSA-27jg-5m5x-f2g4.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-27jg-5m5x-f2g4",
4+
"modified": "2025-05-25T00:31:50Z",
5+
"published": "2025-05-25T00:31:50Z",
6+
"aliases": [
7+
"CVE-2025-5137"
8+
],
9+
"details": "A vulnerability was found in DedeCMS 5.7.117. It has been classified as critical. Affected is an unknown function of the file dede/sys_verifies.php?action=getfiles of the component Incomplete Fix CVE-2018-9175. The manipulation of the argument refiles leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5137"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/CyberPunk-Infernity/Advisory/issues/2"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.310218"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.310218"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.571933"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-05-25T00:15:23Z"
51+
}
52+
}

‎advisories/unreviewed/2025/05/GHSA-fxq6-r9jg-wqh8/GHSA-fxq6-r9jg-wqh8.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-fxq6-r9jg-wqh8",
4+
"modified": "2025-05-25T00:31:50Z",
5+
"published": "2025-05-25T00:31:50Z",
6+
"aliases": [
7+
"CVE-2025-5134"
8+
],
9+
"details": "A vulnerability classified as problematic was found in Tmall Demo up to 20250505. Affected by this vulnerability is an unknown functionality of the component Buy Item Page. The manipulation of the argument Detailed Address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5134"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/bdkuzma/vuln/issues/13"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.310213"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.310213"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.571939"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-05-24T22:15:25Z"
51+
}
52+
}

‎advisories/unreviewed/2025/05/GHSA-jm9m-9mxg-ppp4/GHSA-jm9m-9mxg-ppp4.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jm9m-9mxg-ppp4",
4+
"modified": "2025-05-25T00:31:50Z",
5+
"published": "2025-05-25T00:31:50Z",
6+
"aliases": [
7+
"CVE-2025-5133"
8+
],
9+
"details": "A vulnerability classified as problematic has been found in Tmall Demo up to 20250505. Affected is an unknown function of the component Search Box. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5133"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/bdkuzma/vuln/issues/12"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.310212"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.310212"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.571932"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-79"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2025-05-24T22:15:23Z"
51+
}
52+
}

‎advisories/unreviewed/2025/05/GHSA-vwr5-vc8h-j5xm/GHSA-vwr5-vc8h-j5xm.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vwr5-vc8h-j5xm",
4+
"modified": "2025-05-25T00:31:50Z",
5+
"published": "2025-05-25T00:31:50Z",
6+
"aliases": [
7+
"CVE-2025-5136"
8+
],
9+
"details": "A vulnerability, which was classified as problematic, was found in Tmall Demo up to 20250505. This affects an unknown part of the file /tmall/order/pay/ of the component Payment Identifier Handler. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5136"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/bdkuzma/vuln/issues/15"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.310215"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.310215"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.571960"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [],
45+
"severity": "MODERATE",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2025-05-25T00:15:23Z"
49+
}
50+
}

0 commit comments

Comments
 (0)